Expert Agentic SOC – Cybersecurity Automation & Threat Detection - Onsite in Abu Dhabi (m/f/d)

Responsibilities

• Design and implementation of agent-based use cases for the automated analysis of phishing, BEC, and email-based security incidents, including actionable recommendations for the SOC.
• Automation of alert triage in SIEM/XDR environments to reduce false positives, including context enrichment, preliminary assessment, and clear ticket documentation.
• Execution of cross-platform threat hunting approaches across SIEM, EDR, and cloud logs, as well as the derivation of robust attack hypotheses and timelines.
• Integration and orchestration of LLM and agent frameworks into existing SOC processes, taking into account security guardrails and controlled automation.
• Development and validation of search queries and detection logic in KQL and SPL to support automated investigations and hunting scenarios.
• Connecting relevant interfaces—such as identity providers, ticketing systems, and email platforms—via APIs to enable end-to-end automation of analysis and response workflows.
• Establishment of mechanisms for monitoring credential leaks, fraudulent domains, and external threat indicators using OSINT and threat intelligence sources.
• Defining and implementing controlled response measures such as endpoint isolation, temporary revocation of privileges, or MFA enforcement in line with a zero-trust approach.
• Close collaboration with an international security team on operational incident handling, prioritizing critical findings, and continuously improving SOC processes.

Requirements